Exoscale vs Scaleway

Vendor states regular independent audits and publishes multi-framework certs via Compliance Center; not a VPN-style no-logs audit. Download current reports under account/NDA for verification.

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Vendor asserts ISO/IEC 27001:2022 ISMS certification since 2018; certificates via Compliance Center.

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

Listed on compliance site as certified cloud security controls.

Listed on compliance site for personal data protection in public cloud.

SOC 2 listed on compliance marketing; obtain report via Compliance Center / NDA.

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

BSI C5 listed among national/international standards on compliance page.

HDS listed on compliance page; confirm scope and zones for health workloads.

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

CSA STAR listed on compliance page.

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

Swiss entity; GDPR + Swiss FADP claims; EU zones; public DPA. Not legal advice.

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

Swiss operator, no known US parent, European workload zones, and no third-party processor for compute/storage/SKS customer data. Medium residual path via US ops providers (AWS archival, Twilio auth, PayPal) listed for client data. DBaaS uses Aiven (Finland). Not legal advice.

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Public DPA for Akenes SA as processor; Swiss law; Aiven listed for DBaaS.

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

Primary product is IaaS/managed infrastructure; customer AI workloads remain customer-controlled. Concrete AI offerings may need separate review if used as an AI system.

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Privacy policy lists AWS (US) data archival, Twilio (US) authentication, and PayPal (US) among client operations providers. Vendor states customer-uploaded service data is not transferred to these providers, but account/ops data paths still matter for CLOUD Act and transfer diligence.

Managed databases depend on Aiven Oy (Finland) for orchestration while instances run on Exoscale. Confirm contractual chain, access model, and zone placement for sensitive data.

ISO/SOC/C5/HDS claims are strong marketing signals, but full certificates and SOC reports typically require Compliance Center access or NDA—not fully public PDFs for all frameworks.

Expect solid IaaS, SKS, DBaaS, storage, and GPU—not the global proprietary service catalog of AWS/Azure/GCP. Validate feature gaps early for serverless, global edge, and specialized managed services.

Public materials discuss further European expansion (e.g. Spain via A1 Digital messaging). Treat the live datacenters page as source of truth for residency commitments.

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.